In recent years, some products such as printer cartridges, batteries and game-machine cartridges have been provided with an authentication function to prevent clone products (i.e., counterfeit products) from being introduced. An authentication function may be implemented by use of confidential information (e.g., private key) that guarantees the genuineness of products. However, confidential information stored in the nonvolatile memory embedded in an IC chip may be at the risk of being stolen by a malignant user. Analysis of the internal structure of an IC chip embedded inside a genuine product by use of a microscope for performing minute inspection may successfully identify the values of confidential information stored in the nonvolatile memory.
A PUF (physically unclonable function) is an effective tool for implementing an authentication function in a secure manner without storing confidential information in a nonvolatile memory. Confidential information generated by a PUF cannot be identified even when analysis utilizing a microscope or the like is performed.
A PUF circuit is provided with a physically unclonable function, and generates a product-specific output value (hereinafter referred to as “product-specific information). Some PUFs generate a specific output without taking an input, and other PUFs serve as a function that receives an input and generates an output responsive to the input. An ideal PUF circuit has the following characteristics. As a first characteristic, a PUF implemented in a given device invariably outputs the same produce-specific information (reproducibility). In the case of a PUF receiving an input, the PUF invariably output the same product-specific information in response to the same input. As a second characteristic, PUFs implemented in different devices output completely different product-specific information (uniqueness). In the case of PUFs receiving an input, the PUFs in different devices output different product-specific information in response to the same input.
In general, a PUF is configured such that the output thereof is determined in response to minute differences in the signal delay and device characteristics of a device attributable to variation between devices. This arrangement makes it possible to implement a PUF output that assumes a value that completely varies from device to device. In the case of such a PUF, a PUF implemented in a given device may produce an output value that varies depending on the operating voltage, operating temperature, or the like. That is, the reproducibility of a PUF output is not 100%. Some measures for error correction may thus be employed.
PUFs as described above may be utilized to implement an encryption function, thereby improving product security. One example is a smartcard. Further, confidentiality of communication is guaranteed by utilizing encryption functions in terminals for wireless Internet connection and in the SIM cards of portable phones. To this end, PUFs may be used in the part that generates an encryption key. Such an arrangement significantly reduces the risk of an encryption key being successfully analyzed by a malignant user, thereby improving security.
An authentication system that uses a PUF with an input and an authentication system that uses a PUF without an input have respective, different configurations and characteristics, and have respective advantages and disadvantages.
A PUF that generates a 1-bit output in response to an n-bit input will be described in the following as an example of a PUF with an input. In the case of such a PUF, there are 2n different combinations of an input and an output. With this PUF, an authentication system will have the configuration as follows. A table is generated that lists 2n pairs of an input and an output in respect of a PUF implemented in a given device (i.e., genuine chip), and is stored in advance in an authentication server. In order to check whether a device in question is a genuine product, the authentication server applies an input to the device in question, and checks whether the output value returned in response to the input is in agreement with the output value listed in the table stored in the server, thereby performing authentication. The input that is applied to a device in question is referred to as a “challenge”, and the output of the device in question is referred to as a “response”.
In the case of this procedure, the large size of the table stored in the server for authentication may give rise to a problem. A given product may be subjected to authentication 10000 times during the life cycle of this product. In such a case, a minimum of 10000 pairs of a challenge and a response need to be in existence in the server. Since the values listed in the table differ from PUF to PUF (i.e., differ for each chip in question), tables as many as the number of sold chips need to be stored in the authentication server. As a result, the total size of tables stored in the authentication server becomes enormous, resulting in an increase in the time required for authentication. Further, the reproducibility of a PUF may not be 100%. In such a case, the server may be provided in advance with a mechanism for correcting an error, which results in an cost increase.
In the case of using a PUF without an input, there is supposed to be only one invariable output pattern. In consideration of this, a system that enables the provision of an authentication system by combining an encryption function with the output of a PUF serving as a key may be used. To be more specific, a plurality of output bits generated by a PUF embedded in a given device are stored in a register within the device. The data stored in the register is to be used as a key input into an encryption function. An authentication server has the key and the encryption function registered therein. In order to check whether a device in question is a genuine product, the authentication server supplies a plaintext input serving as a challenge to the encryption function of the device in question, which then produces an encrypted text as a response. This response is matched against the output that is internally generated in the authentication server by using the key and the encryption function in the authentication server, thereby performing authentication. In the case of reproducibility being not 100%, the output of the PUF may contain error. Error correction code or the like may be used to correct the data, which is then registered in the register.
The use of the above-noted configuration does not require a large size table in an authentication server, thereby offering a high degree of convenience. Such an authentication system, however, may have a low level of anti-counterfeiting security. One possible attack point may be the correction data that is used to correct error in the output of the PUF. The correction data is supposed to be stored in a nonvolatile memory. A malignant user may thus be able to read the correction data by reverse engineering. As a result, there is a risk of the key being compromised based on the correction data. Another possible attack point may be the register that stores the key. A malignant user may use a side-channel attack or the like to identify the key stored in the register. When this happens, the security of the authentication system is totally compromised.
Among the related-art configurations as described above, the authentication system that uses table data and a PUF with an input requires a large amount of data to be stored in the authentication server, which poses a problem in practical application. The authentication system that uses an encryption function and a key provided by a PUF without an input has a low level of security against an attack. It may be noted that the objective is to prevent a counterfeit product from being manufactured. Ultimately, therefore, achieving this objective is what is desired regardless of the presence or absence of an authentication system. Accordingly, it may be desirable to provide a semiconductor integrated circuit that utilizes a PUF to effectively and efficiently prevent a counterfeit product from being manufactured.
[Patent Document 1] Japanese National Publication of International Patent Application No. 2005-523481
[Patent Document 2] Japanese National Publication of International Patent Application No. 2007-509563
[Patent Document 3] Japanese National Publication of International Patent Application No. 2008-514975